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SYSTEM FOR MONUOIONG AND 
MANAGING COMPOTER RESOURCES AND 
APPUCATIONS ACROSS A DISTRIBUTEX) 
COMPUTING ENVIRONMENT USING AN 
INTELUGENT AUTONOMOUS AGENT 
ARCHITECTURE 

FIELD OF THE INVeNTION 

niis invcntiOQ relates generally to compuitr newfc'oxks. 
More specifically, the invcnaon relates to a method aad 
apparatus for cemrally monitoring and maoaging the 
coinputas. applications and other reiourccs pnjscnt in a 
distributed coiupuciQg eiivironment. 

BACKGROUND 
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TTie data proc<i«$ing resource* of business oigaaizatioos 
are mCTeasio^y taking the /oraa of a distributed compuiinP 
environment in daca and processing arc dispersed 

over a nctworlc corepriaing naany interconnected, hetcroge- 
Qeou5 and gcogr^hicaUy remote compuicn. Among die 
reasons for this af^roach arc to offload non-mission^ticai 
processing from the mainfirame, to provide a piagnutio 
alternative to centralized cotporatc databases, to establish a 
single computing environment, to move control into the „ 
operating divisions of the company, and to avoid haviag a 
single point of feUure, For example, many business cntlttes 
have one cUcnt/scrvcr netwoilc instaUed in each regional 
ofiEcc, in which a high-capacity computer system operates m xTtn ^ r. 

the "server** sappc^Ting lowcr-^padry "client" desk- u "^'^^^ritcs the main components for in^emcnting 
top computers The Sdvcrs in such nbusines,s entity arc also ^ software system 34 shown 

" ' * ^"*^^^l^«M^>d*Jc parser 44 is responsible for accc« 

knowledge module 38 and parsing the information ttiaein 
by knowledge databage^jQAnaner 4g. whidi in turn 
creates ana mamtaios a database 47 of knowledge diat is 
morercadUy useable by manager software system 34 than 
would be the data stored in knowledge module 3a Object 

„ ^ ^ ^ ^ database iiianapcc^45 creates and maintains a database 49 

manage such a divene VL^^d^'^^^ ^^t^^ ^ resources and «;;nT?ri;^ 

m;,nyrea«,ns.Serversir«tall«lin L^tZ^^Z.^IlziY!^ f^«>Uwttvelyr3^?JpFS^ 


other servo- con^jutcr systems in (he network might be built 

around yet other hardware/software pbiforms. In addition, r I t m L'^i 
an of ibc iefw computers in tbc network miglit be coupled * ' ^ ^\ . 
to a variety of supported cUcnt computers juch as desk-top ,J^^ ^ ^ diA 
computers, workstations and other resources. It is t/o^'^ 
anticipated. howcv«jjn RG. 1 that network management 
computer system I^Tm^ ^afih-of the server computer sys- 
tems in the netwoxk will be equij^jcd with seme sgrt of CPU 
16, 18, some son of conventional input/output equipment 
20, 22 such as a keyboard and a display monitor, some sort 
of conventional data stornge device 24, 26 such as a disk or 
tape drive or CD ROM drive, some sort of random access 
memoiy C^RAM") 28. 29, and some sort of conventional 
network c omm imi c a t ion hardware 30» 32 such as an ETH- 
ERNBT intttfece unit for physically coupling the computer 
system to nctwodc 12. In die syatem of TO. I, network 12 
may be implemented using any conventional network pn)- 
tocol such as rCP/IR In the configuration shown in FIG. 1, 
a manager *oftware system 34 is stored on stocagc device 24 
in network managemcni axnputcr system 10; one agent 
software system is Instafled on each of the server con^tcr 
systems in the networfc, such as agent software cvstgni Atf 
shown stored on storage dcyice26 in sccw oomxiter 
system 14; at least one knowledge module 38 is stored on 
storage device 24 in network management eomputer system 
and al least one scxipl program 40, 42 is stored on each 
of the storage devices 24, 26 throughout the computer 
networiL 


— g uMw^ kvwM-^^^ouij^ VUCllL yCSK*> 

top computers. The servers in such a busines,s entity arc also 
commonly eonnocled to one anothejc by a highcr^lcvcl net- 
work known as a wide area network. In this mannff, users 
at any location within the business entity can Uicorecically 
access resources available in the company's network regard- 
less of where the resource is located 

The flejubiiity gained for users witfi this type of axrange- 
mcDt coincs with a price, however. It (s very difficult to 
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many reasons. Servers itwtalled in the wide area network are ^ w ' ' ^: ^^^^^^^ ui^wwi, as ^ 

frequcndy oot aU of the same variety. One regional office 1 ^ * fn^ SS P"'*^ to the state of tho^e <*jects, 

ma„ TOW .f. ™ m a^nrifia wiU be readUy tweabto by a graphical user 

databases " ' " 


may be using an IBM machine with a UNDC opcratine ««r..rS:^';::i;,t:TA";;^^=x=^ ^^SL. - _ . 
system, whfle another regional office may be usi^TDEC DaSESSs 47SEJ49 may be stored in 

machine with a VMS operating system. Also, a^Ucations lu^i;^^ "^^"f^^ ^ 

pccscnioatticsaTcrs throughout the network vaS^notonS .JS?«ii?5^ responsible foWWmnicating with 
in terms of type, but also prodnci release levd within an ^^tt^iJx^^^f*^ IMesent^dOTalrcew^- 
ar,^:-..,:™ V* ^ HBBons oLobkccsl^ th^splg^f network laaaagemcac 


api^canon type. Moreover, die applications avaflabic are 
changed frequently by users tJirottghout Ihe networt and 
failure events in such a netwoifc are usually difficult to catch 

until aft» a failure has already occurrcdL Thus, a need exists 50 
for an eflacicnt and flexible cntexpiisc roanagcment system, 
By way of bBcfcgfound, one computer network manage- 
ment system was implemented in the fashion shown sche- 
matically in FIG. L In RfO. 1, a network management 
computer system 10 Is coupled via oetworfc 12 to aava^ 
computar system 14 and a plurality of other scrv«x compute 
systems. The haidwaro present in each of the computer 
systems may be of any convendotial type such as is lypieaUy 
found on server computers in a clicnt/servcr necwork envi- 
ronment Moieovoc, the hardware configuration of eadi of |go 
the computer systems need not be die same. For example, 
network management computer system la might be built 
around a compuccc sold by Intematioftal Business Marfunes 
Coqjoration operating widi me wcltknown UNIX opaatlng 
system, while server computer system 14 might be buUt 
arxwnd a computer sold by Digital B^uipmflit Coxpcration 
operating widi the wdl-lmown VMS opcratiflg system. The 


10. Sucfil^cAeatatioiis typically Uke the I 
for objeetcUlso. gri^>hici] user intecfacei 
the repoescotatioti of ^ 


W»mifvu hlimEfii1t and 

""^JjVejtmanagCT^is iBsponsibl 
fious occuocnoculhrDi 


5 for i 
' compirte'<« 


ssra^^'^B^'^^^vcttlctice. Intcrfioe S4 is for the purpose of 
Tfitetftong with n^work management softwarts othgthan 
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itetftdng wift n^work management softwarts "othor than 
the manager software system 34 aod agent softwm'sy^em 
36. For example, users of necwork tnanagemcnt computer 
system 10 may make use of software such as Hewlett 
Padcard Cwpocation's OPENVIEW product for the pa 
of monitoring low-level networtt conditions such ^ 


"^^^cA 

iu/ '.^'^wMWA.ww ** — y using such a IhTO^pA?^! fk<($rcAc 
ko. "S;™ ™^ ^ • ™toSL tod request iflfomiaJ *^^Mr*lcft/^ 
dM&om manager software systcia 34, in which case 
mtofaoeSd will oootdlnate cozmmmlcatiQn becwt^ mm- 
_goftym systom 34 npA such third party product 
I0^i!e^56|s ic^Qsible for handling all 
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modules are UDioadcfl from knowledge database 75. llitu 
nuking more efficient use of server lesouiccj. 
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Resource Mojutoriag and Data Reporting wiih 
Event Piltenng 

(Event filtering allows ^ cops^g Antettstcd in a pi 
object to be selective aboutBie e^ms It wants to b ^otiflj 
a bout in rela tion to the obJea. 

plG. 22/ llugDcatet a prcfcncd data stnicturc for imple- 
nieatiag cvcut filtering. Eve&t fUlcr sliucturc 32* iadudts 
four fields. Field 322 detomlAts whether the event filta is 
a PASS type filter or a FAIL type filter. FieW 324 may 
contain infonnation idcotirying events* by the came of an 
object o Tpt of objects potential causin^^ the cyenL ' For 
example^ field 324 might contain an applica^9p dmi^h^ 
in^tancf^ HflPf <x pa rameter pame, fldd 326 may contain 
Uinfoniatxofi IdeagJ^dqe events by "type, such as a ante* 
^g.tO^ ^ t^'^^Tt changc event <tf^OT^event Field 32g may contain infor- 

jStwn idcntifyiSl^nts by sevediy lovci, such as jlann 

severity: Earning severity, or sin^?ly i nformation-leyel ^° oonsote thai an event ha? 
severity. Fleldj 324, 326 and 328 may abo contain wiid-cazd 
characters. 

Fdtcring may be explained by way of example with 
reference to FKj. 23 TFIG. 23} iliQsirate3 a sequence of two 
"cfaaiped** filters, filters A and B. These two filters arc 


the invention. Each time the routine is executed, a record of 1 

the event is logeed into event repository 206. Th en, two ^ 

nested loops are executed, 'fhe outennost loop repeats for all / 

consoles regLstectd in tabic 250. The innenikost loop repeats j 

for all event filters in the chain of filters identified the S 

event context infotmatlo^^pred in field 256 of table 250 for ' 

each fegist^^oonsok.Trhe effect of the routine is that ^ oHL't 

evcBtfi^ ^B ig)orted to interested consoles, and even \ tePtE^ 

then only fermtetcstcd consoles whose eyeat filtcn arc L ^ 

satisfied^ the evenjL|This procedure provide enhanced 7 

pafonoAnce by, among ochci things, reducing network ' 
traflLc 
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desiigEied ouch that if all events generated wae tested against 
filter A firsthand thea^ filier B, the result would be that all 

events would pass throug b filtg A , but apy evetiA(of the tvpc ^ ^ ^ „„, ^ 

having an infomation4evel stycdvy would be smeoed the status of'th e jgvent is "aOfaoo^ijc dgedL'* In step 352, the 


Event Management 

FIG. 26 is a flow diagram iUustcating a prcfcncd proce- 
dure for managing events in an entcqidse management 
system like that of FIG. 11. It n^jLiie aoderstood that Hie 
procedure of FIG* 26 w ould begiffa ft ^ ttie event [rooessiog 
routing of FIO. Zg.gCDt 6me«^jit o^ynsolc notifyinf &e 
_ i ocqgrea ^^after ( he uca at the 
oobsole clecidriTco tate rcsponslhinag far handling fiic 
repotted event In step 34i. aftef the user taking responsl- 
bificy for die event makes ah ^2£2Brialcxite*this consge, 
the console sends a m^sage to the agent so indicting. In 
step 350, the agent modifies event repository Z06 aocord- 
in^y. For exan^lo, the agent would modify field 238 to / 
idotfilytheooDSOieortheufiertaldngrcsponilblUtyforthe 
event The agent might abo modify fidd 232 indicating tiiat 


would not pass throne h flJiter B , In other words, aU events 
having a severity fcvcl higher than the information level of 
severity woold pass through both eytat filters and be tce- 
ognized, 

A preferred procedure for monitoring resources, process- 
ing events and reponiiig data lo consoles will nuw be 
discussed in relation to FIG. 24 and 25. 

As can be seen in step 330, FIG. 24 is a loop (hat is 
repeated for each resource that the agent is supposcd-to 


35 


agent uses the data structures of FSSTI? and 1ft to send a 
message t o cyciYJ Xjnsole jntM^g ed in (his event. Sudi a 
message would include, for example, an indication of the 
fact that a console has taken responstbUiiy for the event, and 
an indication of the identity of the responsible console. It 
will be undo^tted that all other information perrigciit to the 
event may{1Jso)be seat in such a message aoooiding to . 
procedures already describied above. In step 354, the con- V 

^ soles receiving a message sent by (he agent in stq> 352 l 

inoaitor pursuant to (he default Usi of i^ouieesfouid^^ 40 modify fee entrie s in their own event caches 2X2. The result L 
configuration file during agent ioitiAlization and pursuant to proceSJc is th'at the inioimatloo maiutalaed in the T/ 

the registratiOD infomatioD received and stored from regis- agent's eymt rp^torv is pcopngatod throughout the net- n 
tcriflg consc^es as described above. In step 332, the agent work4 glggTOtPd>ooasoly , such that &e event manage*. — * j 
checks the mtg of the resource. In step 334, the agent meat effom~of ail iiUarestqd copsoieg will be agtomattcally 
determines whether the sute of the resource has changed 45 coocdinatod, and siicKTE^ffl)such consoles will have act^ 


relative to the information stored for example, in field 276. 
If the state has changed, (be agent continues with step 336. 
in which it executes the event processing routine of FIG. 25 
(to be discussed below). IF not, the agent continues with step 
338. in which it calculates ibe value of (he parameters 50 
associated with this resource. In step 339, the parameter 
values are sto^in (he data scmcture described in FIG. 14. 
In,^^ 34#| die agent send^ the calculated parameter values 
t^ajoasole&tqfis^g^ (hat 
iasunee sad parameter. In step 342, the ageiutSQIIW^ (he 
value of every parameter against a aiicd&old<asuaUy stored 
in a knowledge module) to detetmine if a' 'OTOfaoid-aosgw g 
event h as occurred. If so, then the agent continues with st^ 
344. in >vhich ii executes the event processing routing of 


to the samet up-to-date uSocmation about the events that 
interest Aem.. 

Mutti'Tlered Problem Management 


FIG. 27A and 27B comprise a block diagram ilLtistrating 
an altanative embodiment of the invention, configured to 
yicid multi'tiercd pco blctfl, jponitorTPg and management 
capabilities in a large-scale enterprise. In suth a 
configuiatioiL, the network is effectcvetvd ivided into two <g 
5J more ticra. such as tiers 362 and 364. It is to be undectood' 
£at agent 356 in the drawing represents a midtitade of other 
similar agents operating in tier 362 in die netwotic Collector 
358 may be a single in termediary agent or it may l)e viewed / 
for purposesofti 


_ , - - r~, --e illusaation as lepresenting a number of 

no. ^. If not the agent arrives at step 346 and repeats the 50 such intennediate agents operating between "aSTSTa 


loop by retumiiig to step 330 if more resources aic to be 

\FIG.2SJ s a pseudo^code listing for illufitnting a prefetred 
l^occdurc f or pfooessiag events. It will be undmtood that 
the pseudo-oode is sho^ for purposes of eiq>iaiutioD only, 
and that persons of adtniry skill in tft^ an may proecam the 
routine differently while stIU renulDlng WitMn Ihe scope of 
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network, such as l)ecween tiers 362 and 364. The cfFca of the 
configuration is to reduce crvcnt-ntoed pefiy^ pp 
^e hifiher tiers o f the aetwock, and also to removenmo of 
tbejoadjif event management from higher level co^des. In 
65 operation, collector 358 rtristere with «geacs 356 as an 
*»5NMPjnanages>aod (hcrefM bB^i«Q^|Miab: 
patSNMP trm>i» CoUectqr 358 thco<^veit&the 
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